feat(dev): preload fixtures in disposable VM shell

[benvinegar]

Problem

Manual Firecracker investigations repeatedly spend setup time recreating useful patches before Hunk can be exercised. The disposable shell already has a constrained host-to-guest staging path, but only uses it for the optional local Hunk build.

Approach

• Always stage curated, CLI-runnable example inputs under /root/fixtures/examples in both VM modes.
• Generate three deterministic benchmark-shaped patches under /root/fixtures/benchmarks: many small files, a balanced changeset, and one large file.
• Share those workload definitions with the existing changeset parsing benchmark so fixture shapes cannot drift.
• Keep the shell in /root and include /root/fixtures/README.md with ready-to-run commands.
• Generalize the existing owner-only atomic staging snapshot and read-only Docker bind; continue copying into the disposable guest over SSH without mounting the checkout.
• Keep --with-hunk responsible only for building and installing the current Hunk binary and bundled skills. Default mode still contains no Hunk installation.

Non-goals: mounting the checkout, shipping the benchmark harness or dependencies, adding arbitrary host copy paths, persisting fixture state, or changing the install-suite guests.

Validation

• bun test ./test/cli/install-vm/vm-shell.test.ts ./test/cli/install-vm/contract.test.ts
• bwrap --dev-bind / / --tmpfs /tmp --bind /tmp/opencode/hunk-main-fixtures /mnt --chdir /mnt /home/bentlegen/.bun/bin/bun run test (all two shards passed; the mount namespace hides an unrelated host /tmp/node_modules symlink)
• bun run typecheck
• bun run lint
• bun run format:check
• bun run deps:check
• bun run bench:changeset-parse
• bash -n test/cli/install-vm/vm-shell-controller.sh
• shellcheck test/cli/install-vm/vm-shell-controller.sh
• Real Linux x64 KVM smoke, default mode: started in /root, fixture index/example/benchmark present, Hunk absent, clean teardown.
• Real Linux x64 KVM smoke, --with-hunk: fresh binary installed, checked-in example and generated many-file patch rendered successfully, clean teardown.

bun run knip still reports the pre-existing unused resolveGitTreeRefAsync export at packages/hunk-git/src/commands.ts:1093; this change introduces no new Knip findings.

Release Notes

Empty Changeset: this only changes private repository developer tooling.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
hunk-web	Ignored	Preview	Sep 8, 2026 12:11am UTC

[greptile-apps]

Greptile Summary

This PR preloads curated examples and deterministic benchmark-shaped patches into disposable VM shells while keeping installation of the current Hunk build behind --with-hunk.

• Centralizes benchmark workload definitions for reuse by the parser benchmark and VM fixture generator.
• Atomically stages an allowlisted shell payload and exposes it read-only to the VM controller.
• Copies fixtures into /root/fixtures and documents ready-to-run review commands.
• Updates controller contracts, documentation, and tests for both shell modes.

Confidence Score: 4/5

The PR appears safe to merge, with one non-blocking staging robustness issue around validating example files that are not copied.

The new fixture and optional-Hunk flows are internally consistent, but recursively validating entire example directories can make shell startup depend on unrelated, non-staged assets.

Files Needing Attention: test/cli/install-vm/vm-shell.ts, test/cli/install-vm/vm-shell.test.ts

Important Files Changed

Filename	Overview
test/cli/install-vm/vm-shell.ts	Builds the unified fixture/Hunk staging snapshot; its recursive validation unnecessarily covers files outside the payload allowlist.
test/cli/install-vm/vm-shell-controller.sh	Validates the mounted snapshot and copies fixtures plus optional Hunk artifacts into the disposable guest.
test/cli/install-vm/contract.ts	Makes the read-only shell-input bind mandatory while retaining conditional Hunk installation.
benchmarks/lib/fixtures.ts	Defines canonical synthetic patch scenarios shared by benchmarks and VM fixtures.
benchmarks/changeset-parse.ts	Generates parser benchmark inputs from the shared scenario definitions.
test/cli/install-vm/vm-shell.test.ts	Covers staging, fixture validity, Docker arguments, and controller integration, but does not test unrelated entries within selected example directories.

Prompt To Fix All With AI

### Issue 1
test/cli/install-vm/vm-shell.ts:132-134
**Unrelated files block staging**

`stageVmShellInput` recursively validates each selected example’s entire directory, but only copies the files listed in `VM_SHELL_EXAMPLE_FILES`. If an unselected asset such as a file under `before/` or `after/` becomes a symlink or special file, `vm:shell` will fail even though that asset would not enter the payload. Validate only the source files being copied and add coverage for directories containing unselected entries.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat(dev): preload fixtures in disposabl..." | Re-trigger Greptile}